# Windows event not picked by elasticsearch

**URL:** <https://discuss.elastic.co/t/windows-event-not-picked-by-elasticsearch/197029>\
**Category:** Elasticsearch\
**Created:** [August 28, 2019, 5:06am UTC](https://discuss.elastic.co/t/windows-event-not-picked-by-elasticsearch/197029 "2019-08-28T05:06:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JustinJ](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@JustinJ](https://discuss.elastic.co/u/JustinJ)\
**Post date:** [August 28, 2019, 5:06am UTC](https://discuss.elastic.co/t/windows-event-not-picked-by-elasticsearch/197029/1 "2019-08-28T05:06:50Z")

</div>

I am using the following architecture:  
Central event Collector(CEC) (With winlogbeat and filebeat)--\>\>\>Ingest Nodes--\>\>\>Data Nodes--\>\>\>Kibana. The CEC is a windows server and is configured to push all security events. For testing purposes, I stopped the event log services which generated a series of events which can be seen in the event viewer. After the service is resumed, elastic searched received all event logs except one security event log. ---\>the log which says event log service has been shut down (Event ID 1100).

The idea was to test and notify us immediately if the event log service is stopped manually. But the specific security log is not taken up by elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2019, 5:06am UTC](https://discuss.elastic.co/t/windows-event-not-picked-by-elasticsearch/197029/2 "2019-09-25T05:06:51Z")

</div>

Closed on September 25, 2019, 5:06am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.